PT-2023-18788 · Mediawiki+1 · Growthexperiments+1
CVSS v3.1
4.3
Média
| Vetor | AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:N |
Name of the Vulnerable Software and Affected Versions
GrowthExperiments extension for MediaWiki versions 1.39 and earlier
Description
The issue allows blocked users to enroll as mentors or edit their mentorship-related properties through the "growthmanagementorlist" API endpoint. This affects users blocked in ApiManageMentorList.
Recommendations
For versions 1.39 and earlier, as a temporary workaround, consider disabling the
growthmanagementorlist API endpoint until a patch is available. Restrict access to the ApiManageMentorList to minimize the risk of exploitation. Avoid using the growthmanagementorlist API endpoint until the issue is resolved.Exploit
Correção
Incorrect Authorization
Encontrou algum problema na descrição? Tem algo a acrescentar? Fique à vontade para nos escrever 👾
Enumeração de Fraquezas
Identificadores relacionados
Produtos afetados
Alt Linux
Growthexperiments